CVE-2025-36016

IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7237502	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:process_mining:2.0.1:-::::::
	cpe:2.3:a:ibm:process_mining:2.0.1:interim_fix_001::::::

History

21 Aug 2025, 01:10

Type	Values Removed	Values Added
First Time		Ibm Ibm process Mining
References	~~() https://www.ibm.com/support/pages/node/7237502 -~~	() https://www.ibm.com/support/pages/node/7237502 - Vendor Advisory
CPE		cpe:2.3:a:ibm:process_mining:2.0.1:-:::::: cpe:2.3:a:ibm:process_mining:2.0.1:interim_fix_001::::::

23 Jun 2025, 20:16

Type	Values Removed	Values Added
Summary		(es) IBM Process Mining 2.0.1 IF001 y 2.0.1 podrían permitir que un atacante remoto realice ataques de phishing mediante un ataque de redirección abierta. Al persuadir a la víctima para que visite un sitio web especialmente manipulado, un atacante remoto podría explotar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso aparentemente confiable. Esto podría permitirle obtener información altamente sensible o realizar nuevos ataques contra la víctima.

21 Jun 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-21 13:15

Updated : 2025-08-21 01:10

NVD link : CVE-2025-36016

Mitre link : CVE-2025-36016

CVE.ORG link : CVE-2025-36016

JSON object : View

Products Affected

ibm

process_mining

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-36016", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2025-06-21T13:15:20.913", "references": [{"url": "https://www.ibm.com/support/pages/node/7237502", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim."}, {"lang": "es", "value": "IBM Process Mining 2.0.1 IF001 y 2.0.1 podr\u00edan permitir que un atacante remoto realice ataques de phishing mediante un ataque de redirecci\u00f3n abierta. Al persuadir a la v\u00edctima para que visite un sitio web especialmente manipulado, un atacante remoto podr\u00eda explotar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso aparentemente confiable. Esto podr\u00eda permitirle obtener informaci\u00f3n altamente sensible o realizar nuevos ataques contra la v\u00edctima."}], "lastModified": "2025-08-21T01:10:59.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:process_mining:2.0.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DE480A0-AEC1-43FF-91E5-31BA250EBFB2"}, {"criteria": "cpe:2.3:a:ibm:process_mining:2.0.1:interim_fix_001:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53CDA010-ED20-4AB7-B3F1-7EAF5BF52DE9"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}